Technology explainer
How a Malicious Code-Editor Extension Can Persist Outside Its Install Folder
Editor extensions can execute code with a developer's permissions, write SSH keys and startup files, and leave persistence behind even after the extension itself is removed.
Code-editor extensions are software, not passive documents. Depending on the editor and permissions, they can read project files, start processes and access developer tools.
Why uninstalling may not be enough
A malicious extension can write files outside its installation directory, including SSH authorization entries, scheduled tasks, launch agents or shell scripts. Removing the package does not automatically remove those artifacts.
How reverse access works
Malware may start an outbound SSH tunnel to an attacker-controlled server. Outbound traffic can pass network controls that would block a direct inbound connection, while a planted key authorizes later access if the local SSH service is reachable.
What investigation requires
Responders should preserve evidence, inspect extension versions and startup objects, review process and network telemetry, remove confirmed malicious artifacts and rotate exposed credentials from a trusted device.
First appeared in
A Trojanized Claude Code Extension Tried to Plant an SSH Backdoor
